# Best approach to separate account info (newbie)

**URL:** <https://www.ruby-forum.com/t/best-approach-to-separate-account-info-newbie/131391>\
**Category:** Rails\
**Created:** [March 9, 2008, 7:11am UTC](https://www.ruby-forum.com/t/best-approach-to-separate-account-info-newbie/131391 "2008-03-09T07:11:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [March 9, 2008, 7:11am UTC](https://www.ruby-forum.com/t/best-approach-to-separate-account-info-newbie/131391/1 "2008-03-09T07:11:37Z")

</div>

I’m building something very common to most web applications: there are  
multiple users, and each user has its own set of resources (e.g.  
documents).  
And I need a way of ensuring one user cannot access the resource of  
another  
user by simply typing something like /documents/3 into the URL, if 3 is  
the  
ID of a document by another user.  
One way I see is to verify for every request, that the resource being  
accessed actually belongs to the current user. But perhaps a more  
elegant  
approach is to scope the ID of resource to the user, so the post with ID  
3  
refers to different post for different user, essentially having a  
composite  
key; but I’m not sure how that would play with Rails’ preference for  
global  
primary key.

Any thoughts appreciated.